Visitors of your website

How many people come to your site, what do they read, and where do they come from? That is under Statistics in CoreCP, and there is nothing to install for it. No script in your pages, no cookie on your visitor, no extra service to sign up for. The server already records the requests it answers, and CoreCP turns that into a report every hour.

Visitors' addresses are cut short before anything is stored. More about that at the bottom, under What happens to privacy.

Where to find it

1. Click Statistics in the sidebar.
2. Click your account, then the website you want to look at.
3. Two tabs appear at the top: Overview and Full report.

Both tabs have their own web address, so a link to the full report is one you can send on or keep as a bookmark.

Overview: how much

The Overview tab answers how much. Charts by hour or by day: traffic, visits, requests and errors. The period switcher is at the top right — 24 hours, 7 days, 30 days, 90 days or a year.

Note one word: it says visits, not "unique visitors". Somebody who comes on Monday and again on Tuesday is one person and two visits. Uniques cannot be added up across days, so CoreCP never prints a total that would suggest they can.

Full report: what

The Full report tab answers what. It covers the last 35 days and has five blocks:

What was read — your most requested pages. Images, stylesheets and scripts are left out; these are pages somebody actually read.

Where visitors came from — the referring website on the left (google.com, bbc.co.uk), the full referring link on the right. Visitors who typed your address or came from a bookmark are not here: their browser sends no referrer. That is normal and does not mean you are missing anything.

What was not found — addresses that answered with a 404. This is the block with the most value in it. If a page of your own site appears often, you have a wrong link somewhere, or an old page moved without a redirect. Addresses like /wp-login.php or /.env that you never had are robots trying their luck — nothing to do about those.

What people read it with — browsers, operating systems and the status codes your site returned. Useful when you are deciding whether testing something on mobile is worth the afternoon.

Visiting addresses (masked) — exactly as they are stored, so cut short. The list is there so you can check for yourself that no whole addresses are kept.

What happens to privacy

The report is produced on the server itself, by GoAccess, from the ordinary logs the webserver writes anyway. Two things are fixed about that:

• IP addresses are cut to 16 bits before anything is stored. 203.0.113.45 becomes 203.0.0.0, and 2001:db8:1234:5678::1 becomes 2001:db8:1234::. After that the report cannot point at a visitor.
• The raw logs stay on the server. The panel only ever sees the report, never the log lines. (If you do want to read the raw lines — you may, they are your logs — that is under Logs; see Reading logs.)

The window is 35 days. Anything older disappears by itself.

When you see dashes instead of numbers

Then there is no report, and the reason is always on screen. There are three:

"This server runs LiteSpeed." LiteSpeed rolls its logs itself, into filenames of its own, so the report reader cannot reliably keep track of what it has already read. A report that quietly misses a chunk every week is worse than no report, so we do not produce one. The Overview tab works normally on such a server: those counts come from a different reader.

"GoAccess is not installed on this server." That happens on a server that was already there before this feature existed. Ask your administrator to reconcile the web role; the report appears by itself afterwards.

"There is nothing to report yet." The website was just created, or nobody has visited it. The server rebuilds the report every hour.

For administrators: on the server itself

Everything the panel shows can be asked for on the server too:

# One website's report, as text
corectl stats report --domain example.com

# Rebuild every report on this server now (the agent normally does it hourly)
corectl stats report-refresh

# The counts beside it, by day
corectl stats web --domain example.com --resolution day

To see for yourself that the masking really happens, look in the stored report:

jq '.report.hosts[].key' /var/lib/corecp/stats/reports/example.com/report.json

"84.28.0.0"
"2001:1c00::"
"145.53.0.0"

Not a whole address in sight — which is exactly what the screen shows.

See also

• Reading logs — the raw lines behind these numbers.
• Where a website is served — which server your site sits on.